[code-deduplication] Consolidate CLI network argument forwarding

[Pedro Henrique Penna (ppenna)]

Deduplication

command_run() and one-shot command_sandbox() each contained the same ordered network-option forwarding sequence for the address/profile pair, ingress and egress policy, repeated allow and deny rules, host-loopback policy, proxy endpoint, and repeated port forwards. This change consolidates both inline copies into the module-private _extend_network_arguments() helper in scripts/nvx.py.

The helper accepts only the command and the existing parsed namespace, adds no flags or branches, and preserves the original argument order, values, and absence behavior. The focused test invokes both call sites with every forwarded option and verifies their exact resulting suffixes.

Evidence and novelty

• Consolidated copy 1: command_run() in scripts/nvx.py.
• Consolidated copy 2: one-shot command_sandbox() in scripts/nvx.py.
• Resulting helper: _extend_network_arguments() in scripts/nvx.py.
• Live issue and pull-request searches found no proposal for this consolidation. The only active workflow PR changes benchmark metadata error handling in performance.py; it does not touch this function or concern.
• Related merged PRs [code-improvement] documentation: document run network policy options #220, docs: sync microVM design with the pinned OpenVMM implementation #227, and [code-quality] Reject malformed sandbox network lists #243 document network policy or validate persisted sandbox network lists; none consolidates CLI forwarding. Prior code-deduplication PRs [code-deduplication] Consolidate adversarial oracle failure cleanup #241 and [code-deduplication] Consolidate runtime provenance path resolution #245 concern adversarial cleanup and provenance paths.

Patch

• scripts/nvx.py: 21 additions, 32 deletions.
• scripts/test_nvx_tools.py: 42 additions, 0 deletions.
• Total: 95 added-plus-deleted lines across 2 files; production code deletes 12 more lines than it adds.

Validation

• python3 -m unittest scripts.test_nvx_tools.CliTests.test_run_and_sandbox_forward_network_arguments -v — passed.
• python3 -m unittest scripts/test_performance.py scripts/test_nvx_tools.py scripts/test_microvm_tests.py scripts/test_development_release.py -v — passed.
• python3 scripts/test_adversarial.py -v — passed (54 tests).
• python3 .github/skills/nvx-host-connect/scripts/test_hosts.py -v plus every CLI help smoke command from validate-nvx — passed.
• python3 -m compileall -q scripts — passed.
• python3 -m ruff check scripts — passed.
• python3 -m pyright --pythonplatform Linux — passed with 0 errors.
• python3 -m pyright --pythonplatform Windows — passed with 0 errors.
• python3 -m ruff format --check scripts — passed.
• git diff --check — passed.

No dependency, public API/CLI/ABI, gitlink, or OpenVMM change was made.

Generated by code-deduplication · copilot · gpt56 · 126.7 AIC · ⌖ 29.1 AIC · ⊞ 16.3K · ◷

• expires on Oct 13, 2026, 3:01 PM UTC

[Copilot]

Copilot review overview

🟢 Approval recommended

The extraction preserves the existing argument sequence, and the focused test covers both call sites.

Review effort: Balanced
Findings: None

What changed in this PR

This PR consolidates network-option forwarding shared by the run and one-shot sandbox commands, reducing duplication in the NVX CLI.

Changes:

• Extracts the existing forwarding sequence into a private helper.
• Adds a test that checks the forwarded arguments for both commands.

File	Description
scripts/​test_nvx_tools.py	Tests network-option forwarding for both commands.
scripts/​nvx.py	Replaces duplicate forwarding blocks with a shared helper.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.